QUESTION 41
Which interface on the WLC is limited to one when LAG is in use?

A. AP-manager
B. virtual
C. service
D. trunk

Correct Answer: A

QUESTION 42
What are two reasons to configure PortFast on a switch port attached to an end host? (Choose two.)

A. to protect the operation of the port from topology change processes
B. to block another switch or host from communicating through the port
C. to limit the number of MAC addresses leaned on the port to 1
D. to prevent the port from participating in Spanning Tree Protocol operations
E. to enable the port to enter the forwarding state immediately when the host boots up

Correct Answer: AE

QUESTION 43
Which WLC management connection type is vulnerable to man-in-the-middle attacks?

A. Telnet
B. HTTPS
C. SSH
D. Console

Correct Answer: A

QUESTION 44
Which combination of methods satisfies the minimum security requirements when a new multifactor authentication solution is deployed?

A. authorized USB dongle and mobile phone
B. password of 8 to 15 characters and personal 12-digit PIN
C. fingerprint scanning and facial recognition
D. complex password and time-based one-time password

Correct Answer: D

QUESTION 45
Which switch port configuration must be configured when connected to an AP running in FlexConnect mode, and the WLANs use flex local switching?

A. trunk port with pruned VLANs
B. tagged port with MAC Filtering enable
C. Layer 3 port with an IP address
D. access port with one VLAN

Correct Answer: A

QUESTION 46
What is the purpose of using First Hop Redundancy Protocol on a specific subnet?
A. forwards multicast hello messages between routers
B. filters traffic based on destination IP addressing
C. ensures a loop-free physical topology
D. sends the default route to the hosts on a network

Correct Answer: A

QUESTION 47
What is the function of a controller in controller-based networking?

A. It is a pair of core routers that maintain all routing decisions for a campus.
B. It centralizes the data plane for the network.
C. It is the card on a core router that maintains all routing decisions for a campus.
D. It serves as the centralized management point of an SDN architecture.

Correct Answer: D

QUESTION 48
Which IP header field is changed by a Cisco device when QoS marking is enabled?

A. ECN
B. Header Checksum
C. Type of Service
D. DSCP

Correct Answer: D

QUESTION 49
Which two HTTP verbs does a REST-based API call to create a resource? (Choose two.)

A. POST
B. GET
C. DELETE
D. PATCH
E. PUT
Correct Answer: AE

QUESTION 50
Which factor must be considered during the implementation of an IPsec VPN?

A. IPsec transport mode leaves the Layer 4 header unencrypted for inspection.
B. IPsec transport mode increases GRE tunnel security over tunnel mode.
C. In IPsec tunnel mode, the entire original IP datagram is encrypted.
D. In IPsec tunnel mode, only the IP payload is encrypted.

Correct Answer: C

QUESTION 51
What does the term “split MAC” refer to in a wireless architecture?

A. leverages two APs to handle control and data traffic
B. combines the management and control functions from the data-forwarding functions
C. divides data link layer functions between the AP and WLC
D. uses different MAC addresses for 2.4 GHz and 5 GHz bands on the same AP

Correct Answer: C

QUESTION 52
Which technology must be implemented to configure network device monitoring with the highest security?

A. IP SLA
B. Syslog
C. NetFlow
D. SNMPv3

Correct Answer: D

QUESTION 53
Which cipher is supported for wireless encryption only with the WPA2 standard?

A. SHA
B. RC4
C. AES
D. AES256

Correct Answer: C

QUESTION 54
What is a capability of FTP in network management operations?

A. encrypts data before sending between data resources
B. devices are directly connected and use UDP to pass file information
C. uses separate control and data connections to move files between server and client
D. offers proprietary support at the session layer when transferring data

Correct Answer: C

QUESTION 55
An administrator is configuring a Cisco Catalyst switch so that it will accept management connections only from hosts in the 203.0.113.0/24 network. Other traffic
passing through the switch must transit without interruption. Which two configurations must the engineer apply to the router? (Choose two.)

A. ip access-list standard Management
permit 203.0.113.0 0.0.0.255
B. ip access-list extended Management
permit tcp any range 22 23 203.0.113.0 0.0.0.255
C. interface range vlan 1-4094
ip access-group Management out
D. ip access-list standard Management
permit 203.0.113.0 255.255.255.0
E. line vty 0 15
access-class Management in

Correct Answer: AE

QUESTION 56
What is a difference between RADIUS and TACACS+?

A. RADIUS logs all commands that are entered by the administrator, but TACACS+ logs only start, stop, and interim commands.
B. RADIUS is most appropriate for dial authentication, but TACACS+ can be used for multiple types of authentication.
C. TACACS+ separates authentication and authorization, and RADIUS merges them.
D. TACACS+ encrypts only password information, and RADIUS encrypts the entire payload.
Correct Answer: C

QUESTION 57
A network administrator must enable DHCP services between two sites. What must be configured for the router to pass DHCPDISCOVER messages on to the
server?

A. DHCP Binding
B. DHCP Snooping
C. a DHCP Pool
D. a DHCP Relay Agent

Correct Answer: D

QUESTION 58
A network engineer is replacing the switches that belong to a managed-services client with new Cisco Catalyst switches. The new switches will be configured for
updated security standards, including replacing Telnet services with encrypted connections and doubling the modulus size from 1024. Which two commands must
the engineer configure on the new switches? (Choose two.)

A. transport input ssh
B. crypto key generate rsa modulus 2048
C. crypto key generate rsa usage-keys
D. transport input all
E. crypto key generate rsa general-keys modulus 1024

Correct Answer: AB

QUESTION 59
After a recent security breach and a RADIUS failure, an engineer must secure the console port of each enterprise router with a local username and password.
Which configuration must the engineer apply to accomplish this task?

A. username localuser secret plaintextpassword
line con 0
login authentication default
privilege level 15
B. aaa new-model
aaa authorization exec default local
aaa authentication login default radius
username localuser privilege 15 secret plaintextpassword
C. username localuser secret plaintextpassword
line con 0
no login local
privilege level 15
D. aaa new-model
line con 0
password plaintextpassword
privilege level 15

Correct Answer: B

QUESTION 60
An engineer must configure R1 for a new user account. The account must meet these requirements:
1. It must be configured in the local database.
2. The username is engineer2.
3. It must use the strongest password configurable.

Which command must the engineer configure on the router?

A. R1(config)# username engineer2 secret 4 XXXXXXXXXX
B. R1(config)# username engineer2 algorithm-type scrypt secret test2021
C. R1(config)# username engineer2 privilege 1 password 7 test2021
D. R1(config)# username engineer2 secret 5 password XXXXXXXXXX

Correct Answer: B